CVE-2026-98765

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...

UBUNTU-CVE-2026-98765

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...

aircheng-org iWebShop Cross-Site Request Forgery Vulnerability

aircheng-org iWebShop versions 5 and earlier have a security vulnerability. This vulnerability stems from incorrect handling of parameters "password" and "repassword" in the "adminrepwd/adminrepwdact" function in the "Password Change" component. This could lead to cross-site request forgery...

Eptura Archibus authorization issue vulnerability

Versions of Eptura Archibus prior to 2025.02 have an authorization issue vulnerability. This vulnerability stems from improper handling of the DWR request call method. Unauthenticated users can set isPasswordUppercase as a call method and configure the next call method to execute workflow rules,...

Apache Kylin server request forgery vulnerability

Versions 4.0.0 through 5.0.4 of Apache Kylin contain a server-side request forgery vulnerability. This vulnerability stems from Server-Side Request Forgery SSRF and may affect Kylin job services that are directly exposed to the public internet...

Locust cross-site request forgeing vulnerability

Locust 2.46.7 and earlier versions have a cross-site request forgeing vulnerability. This vulnerability is due to a susceptibility to cross-site request forgery attacks. Attackers can trigger cross-site GET requests for /stop and/stats/reset by inducing operators to access malicious pages, thereb...

Apache Camel input validation vulnerability

Versions of Apache Camel prior to 4.18.5, specifically 4.0.0 and 4.22.1 prior to 4.19.0, have a vulnerability related to input validation errors. This vulnerability arises from the Saga processor using a Long-Running-Action header without the Camel prefix to determine which saga the exchange...

CrewAI AMP Suite server-side request forgeing vulnerability

CrewAI AMP Suite versions 1.15.28 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from the fact that the SeleniumScrapingTool does not apply the validateurl private address checking, making it vulnerable to server-side request forgeing attacks. Attackers ca...

Apache Camel input validation vulnerability

Versions of Apache Camel Netty HTTP from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability arises due to the camel-netty-http security constraint using case-sensitive matching when comparing the request path with the configure...

@fastify/oauth2 Cross-Site Request Forgery Vulnerability

The @fastify/oauth2 version from 7.2.0 to 8.3.1 has security vulnerabilities. This vulnerability arises from not specifying the Path attribute when setting the state and code-verifier cookies for login routes. As a result, when OAuth callbacks clear these cookies, the original cookies remain afte...

Apache Camel Cross-Site Request Forgery Vulnerability

Versions of Apache Camel from 4.11.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a cross-site request forgery vulnerability. This vulnerability stems from the OAuth component’s authorization code callback not carrying and verifying the state parameter. This can lead to login cross-site request...

Apache Camel permission and access control vulnerabilities

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain vulnerabilities related to permission handling and access control. These vulnerabilities arise from the Platform HTTP component, which determines whether endpoints run in proxy mode by checking whether a path starts...

Aleksey Hoffman Sigma File Manager: Server Request Forgery Vulnerability

Aleksey Hoffman’s Sigma File Manager versions 2.2.0 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from the validateremoteurl function in security.rs, which does not check the IP address after the extension download command is parsed. As a result, it becom...

Agit8or clientst0r: Server request forgery vulnerability

Agit8or clientst0r 3.17.586 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from the improper handling of url parameters in the fetchhtml function within the Property URL Importer component’s locations/services/propertyurlimporter.py file. It may...

Apache Camel information leakage vulnerability

Versions of Apache Camel from 4.15.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain security vulnerabilities. These vulnerabilities arise from DoclingProducer’s implicit decision-making based on the message body prefix. This can lead to the system treating content starting with http:// or https:// a...

Alex MeTube Server Request Forgery Vulnerability

Alex MeTube’s versions as of September 28, 2026, have a server-side request forgeing vulnerability. This vulnerability stems from improper handling of the DownloadQueue.writefeedmetadatasync function in the Feed-metadata Thumbnail Fetch Handler component. It may lead to server-side request forger...

Apache Camel server-side request forge vulnerability

Versions of Apache Camel prior to 4.18.5, specifically 4.0.0 and 4.22.1 prior to 4.19.0, have a server-side request forge vulnerability. This vulnerability stems from the camel-as2 component extracting the asynchronous MDN return address from inbound messages and using it directly as the outbound...

aio-libs Async HTTP client/server framework: Input validation error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a vulnerability related to input validation errors. This vulnerability stems from the use of a pure Python parser that accepts ambiguous HTTP request frames. This could allow unvalidated attackers to inject HTTP request...

EUVD-2026-103850

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...

CVE-2026-98765

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...